CVE Database›Document archive›CVE-2026-23053

CVE-2026-23053

kernel: Linux kernel: Denial of Service in NFSv4.1 client due to deadlock during memory reclaim

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · February 4, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel. An NFSv4.1 client can experience a deadlock during memory reclaim. This occurs when state recovery waits on kthreadd while kthreadd attempts to reclaim memory by calling nfs_release_folio(), leading to a circular dependency. A local user can trigger this condition by initiating page cache activity on an NFS mount, resulting in hung tasks, system-wide stalls, and a Denial of Service (DoS).

Statement

An NFSv4.1 client can deadlock during memory reclaim because state recovery may wait on kthreadd while kthreadd attempts to reclaim memory by calling nfs_release_folio. The release path may require recovery to make progress, so the two paths can block each other and lead to hung tasks and system wide stalls. For the CVSS the PR is N because normal users can trigger page cache activity on an NFS mount and memory pressure can occur without special privileges. The issue is not directly network reachable. A remote or unstable server can influence recovery timing but the deadlock manifests on the client under local reclaim conditions. Impact is denial of service due to hung reclaim and stalled NFS operations.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-400 · Uncontrolled Resource Consumption